</code></pre></div></details><p>Below you will find sections like <ahref="#core"><code>core</code></a>, <ahref="#advanced"><code>advanced</code></a>, <ahref="#database"><code>database</code></a>, <ahref="#statistics"><code>statistics</code></a>, <ahref="#mail"><code>mail</code></a>, <ahref="#auth"><code>auth</code></a> and <ahref="#web"><code>web</code></a>.<br/> Each section describes the individual configuration keys, their default values, and a brief explanation of their purpose.</p><hr/><h2id="core">Core</h2><p>These are the primary configuration options that control fundamental WireGuard Portal behavior. More advanced options are found in the subsequent <code>Advanced</code> section.</p><h3id="admin_user"><code>admin_user</code></h3><ul><li><strong>Default:</strong><code>admin@wgportal.local</code></li><li><strong>Description:</strong> The administrator user. This user will be created as a default admin if it does not yet exist.</li></ul><h3id="admin_password"><code>admin_password</code></h3><ul><li><strong>Default:</strong><code>wgportal</code></li><li><strong>Description:</strong> The administrator password. The default password of <code>wgportal</code> should be changed immediately.</li></ul><h3id="admin_api_token"><code>admin_api_token</code></h3><ul><li><strong>Default:</strong><em>(empty)</em></li><li><strong>Description:</strong> An API token for the admin user. If a token is provided, the REST API can be accessed using this token. If empty, the API is initially disabled for the admin user.</li></ul><h3id="editable_keys"><code>editable_keys</code></h3><ul><li><strong>Default:</strong><code>true</code></li><li><strong>Description:</strong> Allow editing of WireGuard key-pairs directly in the UI.</li></ul><h3id="create_default_peer"><code>create_default_peer</code></h3><ul><li><strong>Default:</strong><code>false</code></li><li><strong>Description:</strong> If a user logs in for the first time with no existing peers, automatically create a new WireGuard peer for <strong>all</strong> server interfaces.</li></ul><h3id="create_default_peer_on_creation"><code>create_default_peer_on_creation</code></h3><ul><li><strong>Default:</strong><code>false</code></li><li><strong>Description:</strong> If an LDAP user is created (e.g., through LDAP sync) and has no peers, automatically create a new WireGuard peer for <strong>all</strong> server interfaces.</li></ul><h3id="re_enable_peer_after_user_enable"><code>re_enable_peer_after_user_enable</code></h3><ul><li><strong>Default:</strong><code>true</code></li><li><strong>Description:</strong> Re-enable all peers that were previously disabled if the associated user is re-enabled.</li></ul><h3id="delete_peer_after_user_deleted"><code>delete_peer_after_user_deleted</code></h3><ul><li><strong>Default:</strong><code>false</code></li><li><strong>Description:</strong> If a user is deleted, remove all linked peers. Otherwise, peers remain but are disabled.</li></ul><h3id="self_provisioning_allowed"><code>self_provisioning_allowed</code></h3><ul><li><strong>Default:</strong><code>false</code></li><li><strong>Description:</strong> Allow registered (non-admin) users to self-provision peers from their profile page.</li></ul><h3id="import_existing"><code>import_existing</code></h3><ul><li><strong>Default:</strong><code>true</code></li><li><strong>Description:</strong> On startup, import existing WireGuard interfaces and peers into WireGuard Portal.</li></ul><h3id="restore_state"><code>restore_state</code></h3><ul><li><strong>Default:</strong><code>true</code></li><li><strong>Description:</strong> Restore the WireGuard interface states (up/down) that existed before WireGuard Portal started.</li></ul><hr/><h2id="advanced">Advanced</h2><p>Additional or more specialized configuration options for logging and interface creation details.</p><h3id="log_level"><code>log_level</code></h3><ul><li><strong>Default:</strong><code>info</code></li><li><strong>Description:</strong> The log level used by the a
</code></pre></div></li></ul><hr/><h2id="statistics">Statistics</h2><p>Controls how WireGuard Portal collects and reports usage statistics, including ping checks and Prometheus metrics.</p><h3id="use_ping_checks"><code>use_ping_checks</code></h3><ul><li><strong>Default:</strong><code>true</code></li><li><strong>Description:</strong> Enable periodic ping checks to verify that peers remain responsive.</li></ul><h3id="ping_check_workers"><code>ping_check_workers</code></h3><ul><li><strong>Default:</strong><code>10</code></li><li><strong>Description:</strong> Number of parallel worker processes for ping checks.</li></ul><h3id="ping_unprivileged"><code>ping_unprivileged</code></h3><ul><li><strong>Default:</strong><code>false</code></li><li><strong>Description:</strong> If <code>false</code>, ping checks run without root privileges. This is currently considered BETA.</li></ul><h3id="ping_check_interval"><code>ping_check_interval</code></h3><ul><li><strong>Default:</strong><code>1m</code></li><li><strong>Description:</strong> Interval between consecutive ping checks for all peers. Format uses <code>s</code>, <code>m</code>, <code>h</code>, <code>d</code> for seconds, minutes, hours, days, see <ahref="https://golang.org/pkg/time/#ParseDuration">time.ParseDuration</a>.</li></ul><h3id="data_collection_interval"><code>data_collection_interval</code></h3><ul><li><strong>Default:</strong><code>1m</code></li><li><strong>Description:</strong> Interval between data collection cycles (bytes sent/received, handshake times, etc.). Format uses <code>s</code>, <code>m</code>, <code>h</code>, <code>d</code> for seconds, minutes, hours, days, see <ahref="https://golang.org/pkg/time/#ParseDuration">time.ParseDuration</a>.</li></ul><h3id="collect_interface_data"><code>collect_interface_data</code></h3><ul><li><strong>Default:</strong><code>true</code></li><li><strong>Description:</strong> If <code>true</code>, collects interface-level data (bytes in/out) for monitoring and statistics.</li></ul><h3id="collect_peer_data"><code>collect_peer_data</code></h3><ul><li><strong>Default:</strong><code>true</code></li><li><strong>Description:</strong> If <code>true</code>, collects peer-level data (bytes, last handshake, endpoint, etc.).</li></ul><h3id="collect_audit_data"><code>collect_audit_data</code></h3><ul><li><strong>Default:</strong><code>true</code></li><li><strong>Description:</strong> If <code>true</code>, logs certain portal events (such as user logins) to the database.</li></ul><h3id="listening_address"><code>listening_address</code></h3><ul><li><strong>Default:</strong><code>:8787</code></li><li><strong>Description:</strong> Address and port for the integrated Prometheus metric server (e.g., <code>:8787</code>).</li></ul><hr/><h2id="mail">Mail</h2><p>Options for configuring email notifications or sending peer configurations via email.</p><h3id="host"><code>host</code></h3><ul><li><strong>Default:</strong><code>127.0.0.1</code></li><li><strong>Description:</strong> Hostname or IP of the SMTP server.</li></ul><h3id="port"><code>port</code></h3><ul><li><strong>Default:</strong><code>25</code></li><li><strong>Description:</strong> Port number for the SMTP server.</li></ul><h3id="encryption"><code>encryption</code></h3><ul><li><strong>Default:</strong><code>none</code></li><li><strong>Description:</strong> SMTP encryption type. Valid values: <code>none</code>, <code>tls</code>, <code>starttls</code>.</li></ul><h3id="cert_validation"><code>cert_validation</code></h3><ul><li><strong>Default:</strong><code>false</code></li><li><strong>Description:</strong> If <code>true</code>, validate the SMTP server certificate (relevant if <code>encryption</code> = <code>tls</code>).</li></ul><h3id="username"><code>username</code></h3><ul><li><strong>Default:</strong><em>(empty)</em></li><li><strong>Description:</strong> Optional SMTP username for authentication.</li></ul><h3id="password"><code>password</code></h3><ul><li><strong>Default:</strong><em
</code></pre></div></li></ul><h4id="admin_group"><code>admin_group</code></h4><ul><li><strong>Default:</strong><em>(empty)</em></li><li><strong>Description:</strong> A specific LDAP group whose members are considered administrators in WireGuard Portal. For example: <divclass="highlight"><pre><span></span><code>CN=WireGuardAdmins,OU=Some-OU,DC=YOURDOMAIN,DC=LOCAL
</code></pre></div></li></ul><h4id="sync_interval"><code>sync_interval</code></h4><ul><li><strong>Default:</strong><em>(empty)</em></li><li><strong>Description:</strong> How frequently (in duration, e.g. <code>30m</code>) to synchronize users from LDAP. Empty or <code>0</code> disables sync. Format uses <code>s</code>, <code>m</code>, <code>h</code>, <code>d</code> for seconds, minutes, hours, days, see <ahref="https://golang.org/pkg/time/#ParseDuration">time.ParseDuration</a>. Only users that match the <code>sync_filter</code> are synchronized, if <code>disable_missing</code> is <code>true</code>, users not found in LDAP are disabled.</li></ul><h4id="sync_filter"><code>sync_filter</code></h4><ul><li><strong>Default:</strong><em>(empty)</em></li><li><strong>Description:</strong> An LDAP filter to select which users get synchronized into WireGuard Portal. For example: <divclass="highlight"><pre><span></span><code>(&(objectClass=organizationalPerson)(!userAccountControl:1.2.840.113556.1.4.803:=2)(mail=*))
